Privacy Policy
1. Who is responsible for your data
The controller of your personal data is TheBroda sp. z o.o.
For any question about personal data, write to
Cookies are described in detail in our Cookie Policy.
2. What data we process
Only what we need to answer your request and to keep the site working and secure, and, with your consent, for analytics and advertising.
- Request form data: your name, email, phone (if you give it), marketing budget, website or a few words about the business, where your customers are, what you want to promote (in an audit request, what to check), whether you have run ads before, a comment and the consent tick. With them we record which page and which form the request came from, the language version of the site, and the date and time.
- Requests from our ad landing pages
ua.help-context.com anden.help-context.com: the same contact and business details, plus what we record with every form submission, as the privacy policies of those pages say: the address of the page the request was sent from, the referring page, the UTM parameters from the link, the browser language and time zone, and the browser type. - Correspondence and notes: the emails we exchange after your request and our team’s notes in the CRM: the status of the request, what was agreed, next steps.
- Access for the free audit:
if you order an audit and give us read-only access to ad accounts or analytics, we see what that access covers (campaign settings and statistics) and use it only for the audit. - Visit source, only with analytics consent:
how you reach help-context.com: the source and campaign (UTM parameters), the ad click ID (for example gclid or fbclid) and the site you came from, for your first visit and for your last visit from an outside source. We add these data to your request to learn which channels bring in clients. Without this consent, the form sends only the address of the page where you fill it in. - Technical data: IP address, browser and device type, the time of the request and the page address. They are logged by our hosting server and by the Cloudflare network the site runs on. The form server uses the IP address to limit the number of requests from one device and to filter out spam; the request record keeps only an irreversible hash of the IP address, computed with a secret key, never the address itself. Before the form is sent, your browser solves a short computing task from our server that tells people from bots, with no cookies and no outside service.
- Cookies and similar technologies: necessary ones always run; analytics and advertising ones run only with your consent. Details are in the Cookie Policy.
- Client data: if we start working together, data from the contract, invoices and work correspondence.
3. Why we process data and on what legal basis
- Answering your request, the free audit and preparing an offer:
steps taken at your request before entering into a contract, Art. 6(1)(b) GDPR. - Performing the contract if you become our client:
Art. 6(1)(b) GDPR;Art. 6(1)(c) GDPR. - Spam protection, the security of the site and the CRM, defense against possible claims:
our legitimate interest, Art. 6(1)(f) GDPR. - Our own marketing analytics without cookies:
our legitimate interest, Google consent mode).Art. 6(1)(f) GDPR. We see which pages and forms requests come from, to understand which services clients are interested in. This includes the visit data our ad landing pages record with the form, and the basic cookieless signals that Google tags send when there is no consent to analytics or advertising ( - Visit statistics, the visit source in your request, ad measurement and remarketing:
only with the consent you give in the cookie banner, Art. 6(1)(a) GDPR. You can withdraw it at any time.
The consent tick in the form confirms that you ask us to answer your request under this policy; we keep it with the request.
4. Do you have to give us your data
No, it is voluntary. But without your name, email, budget, a website or a few words about the business, and the consent tick, the form will not send the request and we cannot answer. The other fields are optional. Please do not write about health, religion, political views or other special categories of data in the form: a request does not need them.
5. Who receives the data
We store requests in our own CRM, which runs on our hosting; only our team has access to it. A copy of each request goes to our mailbox, and a notification about it goes to our team’s closed work group on Telegram.
We use these providers:
- Hostinger: hosting of the site, the CRM and the request form, including the request database and its backups, and sending system emails; servers in the EU.
- Cloudflare: content delivery network (CDN) and protection of the site against attacks; the site’s traffic passes through it, including visitors’ IP addresses.
- Google: our Google Workspace email, plus Google Tag Manager, Google Analytics 4 and Google Ads. These tools set analytics and advertising cookies only with your consent; without it, Google tags send only basic cookieless signals.
- Meta Platforms: the Meta pixel, only with consent to advertising cookies; without it, no data from the site reaches Meta.
- Supabase: our agency’s infrastructure. The request notifications we send to Telegram, and the presses of the buttons under them, pass through it. Supabase does not store requests; our project runs in the EU region (Ireland).
- Telegram: notifications about new requests in our team’s closed work group (section 6 covers the transfer outside the EEA).
- Our accounting office: only client data needed for invoices and tax returns.
Hostinger, Cloudflare, Google Workspace, Supabase and the accounting office process data on our behalf, as processors, and only as far as needed; Supabase does so under its own data processing agreement (DPA), which includes the standard contractual clauses. Google and Meta also use data from advertising cookies for their own purposes, as separate controllers under their own rules (links in the Cookie Policy). Telegram processes messages under its own privacy policy. We pass data to public authorities only when the law requires it. We do not sell personal data and do not send marketing mailings.
6. Transfers outside the EEA
- Supabase. The service is provided by Supabase Pte. Ltd., based in Singapore. Our project runs in the EU region (Ireland), and the standard contractual clauses that are part of Supabase’s data processing agreement (DPA) cover any transfer outside the EEA.
- Telegram. The messenger is run by Telegram Messenger Inc., a company outside the EEA in a group that includes companies in the British Virgin Islands and the United Arab Emirates. The European Commission has not found that these countries ensure an adequate level of data protection. According to Telegram’s privacy policy, the data of users who signed up in the EEA are stored in data centers in the Netherlands, transfers between the group’s companies rely on standard contractual clauses approved by the European Commission, and Telegram’s representative in the EU is the European Data Protection Office (EDPO) in Brussels. This is why we limit what reaches Telegram: only our team sees the notification, in a closed group; it holds only what we need to answer quickly; and we delete it together with the request.
7. How long we keep data
- Requests that did not lead to work together: up to 3 years from the last activity on the request; then we delete them.
- Requests marked as spam: 90 days.
- Our team’s test requests: 30 days.
- Client data:
for the term of the contract, then as long as Polish tax and accounting law requires (usually 5 years from the end of the year in which the tax payment deadline passed), or until claims become time-barred, whichever is longer. - Proof of consent:
while the consent is valid and, after you withdraw it, until claims become time-barred, so that we can show the consent was given. - Server logs: as long as the site’s security requires, within the periods set by Hostinger and Cloudflare.
- Cookies: their lifetimes are in the Cookie Policy.
The visit source and technical data recorded with a request are kept as long as the request itself. The same periods apply to the copies of requests in our mailbox and to the Telegram notifications. We back up the CRM database daily and keep each backup for 29 days, so a deleted record leaves the backups within 30 days.
8. Your rights
Within the limits set by the GDPR, you have the right to:
- access your data and get a copy of it;
- have inaccurate data corrected;
- ask for your data to be erased or for its processing to be restricted;
receive the data you gave us in a machine-readable format and pass it to another controller;- withdraw your consent at any time; this does not affect the lawfulness of the processing carried out before the withdrawal.
Right to object.
How to use your rights. Write to
Cookie consent. You can change or withdraw it with the “Cookie settings” button at the bottom of every page.
Complaints. If you believe we break data protection rules, you can file a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych
9. Automated decisions
We make no decisions about you based solely on automated processing that would have legal effects on you or affect you in a similarly significant way. Our CRM may automatically flag a request’s priority by budget, market, and whether you have a website and have run ads before, so that we answer faster where we can help; a person always decides whether we take on a project. With your consent to advertising cookies, Google and Meta may use data about your visits to the site to choose the ads you see.
10. How we protect data
11. Changes to this policy
We update this policy when the site, our tools, our providers or the law change. The current version is always on this page, with its date at the top. If a change concerns cookie consent, the banner will ask you to choose again.
12. Our Meta app “Help Context Clients API”
This section is for clients whose ads we run on Meta (Facebook and Instagram). “Help Context Clients API” (app ID 950248784442210) is our working tool: through the Meta Marketing API it connects to a client’s advertising assets on Meta (the ad account, Page, pixel or dataset, and product catalog), only within our work for that client and the access the client has given us. The app does not offer Facebook Login and is not meant for private individuals.
- What it reads and changes: the settings and status of ad accounts, campaigns, ad sets and ads; ad statistics (impressions, reach, clicks, spend, conversions and their value), which Meta provides in aggregate, with no data about the people who saw the ads; basic Page data such as the number of followers; and the settings of pixels, catalogs and the audiences Meta builds from traffic on the client’s site (we cannot see who is in them). At the client’s request we use the app to create and change campaigns, ads, audiences and catalogs.
- Meta lead forms: if a client uses lead forms in its ads and asks us to handle them, the app can receive what people enter in the form (for example name, email, phone). We pass these data to the client and process them only on its behalf.
- Why: running and optimizing campaigns, reports for the client, and checking spend and conversion tracking.
- Legal basis and roles:
our contract with the client. We process personal data found in the client’s assets (for example from lead forms) as a processor on behalf of the client, who remains their controller. We process the data of the client’s contact persons as a controller, to perform the contract and in our legitimate interest (Art. 6(1)(b) and (f) GDPR). - Where the data are kept: the statistics and settings we need for reports are stored in our agency’s reporting system, a database at Supabase (EU region, Ireland). Only our team has access. We do not sell these data, share them with other clients or use them for our own advertising.
- How long: for the duration of our work with the client and 12 months after it ends; then we delete them from our systems. The client can ask us to delete them sooner. Billing documents are kept as long as the law requires.
- How to revoke access and delete data: a client can remove the app’s access at any time in its Meta business settings, or write to us at
[email protected]
Use of the app is also governed by the Meta Platform Terms and Meta’s Developer Policies. People who see the ads are informed about how their data are processed by Meta, a separate controller, in the Meta Privacy Policy.